# MA-538.112015: MyCERT Advisory - Dell Computers Contain CA Root Certificate Vulnerability

**Date:** 30 Nov 2015  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-538.112015  
**Advisory ID:** MA-538.112015

---

#### **1.0 Introduction**
Dell consumer personal computers using the preinstalled certificate authority (CA) root certificate (eDellRoot) contain a critical vulnerability. This preinstalled root certificate resides on newer Dell laptops and desktops.
**2.0 Impact**
Exploitation of the vulnerability could allow a remote attacker to read all encrypted web browser traffic (HTTPS), successfully impersonate (spoof) any website, or perform other attacks on the affected system.
**3.0 Affected Products**
Dell systems that have Dell Foundation Services (DFS) installed.
**4.0 Recommendation**
• Revoke eDellRoot certificate
Revoke the eDellRoot certificate. Using the Windows certificate manager (certmgr.msc), move (<http://huagati.blogspot.my/2015/07/do-you-know-which-cas-can-issue-ssltls.html>) the eDellRoot certificate from the Trusted Root Certificate Store to Untrusted Certificates. Revoking the certificate helps prevent reinstating trust if DFS is reinstalled.
• Remove eDellRoot certificate
Dell has issued guidance (<https://dellupdater.dell.com/Downloads/APP009/eDellRootCertRemovalInstructions.docx> ) to remove the eDellRoot certificate in this blog post. It is important to both remove the eDellRoot certificate and the DFS component that re-installs the certificate. Dell has also provided a removal tool available here:
URL: <https://dellupdater.dell.com/Downloads/APP009/eDellRootCertFix.exe>
Administrators can Configure Trusted Roots and Disallowed Certificates for managed systems:
URL: [https://technet.microsoft.com/en-us/library/dn265983.aspx](https://technet.microsoft.com/en-us/library/dn265983.aspx )
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#5a3923383f286363631a3923383f28293f392f28332e23743723) or [[email protected]](/cdn-cgi/l/email-protection#5c31253f392e281c31253f392e2872332e3b723125)
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYT
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
• <https://www.us-cert.gov/ncas/current-activity/2015/11/24/Dell-Computers-Contain-CA-Root-Certificate-Vulnerability>
• <http://www.kb.cert.org/vuls/id/870761>
• [http://en.community.dell.com/dell-blogs/direct2dell/b/direct2dell/archive/2015/11/23/response-to-concerns-regarding-edellroot-certificate](http://en.community.dell.com/dell-blogs/direct2dell/b/direct2dell/archive/2015/11/23/response-to-concerns-regarding-edellroot-certificate )